CVE-2015-10142
Medium
Description
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
SeverityMedium
CVSS6.9
Exploit probability—
Product
Experience Platform (XP)
PublishedJul 25, 2025
First seenJul 25, 2025
Weakness typeCWE-610CWE-610
How to fix
Update
- Sitecore Experience Platform (XP)8.0 Initial Release (rev. 141212) or later
- Sitecore Content Management System (CMS)7.2 Update-3 (rev. 141226), 7.5 Update-1 (rev. 150130) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sitecore Experience Platform (XP) | v < 8.0 Initial Release (rev. 141212) | 8.0 Initial Release (rev. 141212) |
| Sitecore Content Management System (CMS) | v < 7.2 Update-3 (rev. 141226), v < 7.5 Update-1 (rev. 150130) | 7.2 Update-3 (rev. 141226), 7.5 Update-1 (rev. 150130) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.